go-git CVE-2026-41506

go-git is a pure Go implementation of the Git protocol and HTTP transport. The vulnerability exists in the smart-HTTP transport layer (plumbing/transport/http), which handles the HTTP-based Git protocol including credential negotiation via Authorization headers. The issue stems from improper credential handling when the remote server responds to the initial /info/refs request with a redirect (HTTP 3xx response). Upon receiving a redirect, go-git reuses the session endpoint and-critically-reuses the original authentication credentials (Authorization headers, Basic Auth) when making subsequent requests to the new host. This violates the principle of credential compartmentalization: credentials issued for Host A should never be forwarded to Host B without explicit user approval. The root cause is classified as CWE-522 (Insufficiently Protected Credentials), a credentials management weakness. The fix introduces support for the followRedirects configuration option aligned with upstream Git behavior, allowing applications to enforce stricter redirect policies (default changed to 'initial', which disallows cross-host redirects by default).